FTD 3110 - Change management ip without console access

[JessF]

Hi folks,

I hope someone can help me. I need to change the ip addresses on management interfaces of two FTDs, but I do not have access via console.
I already tried to configure ssh access via one of the data interfaces but I can't get it working. Is there any other way?


Thanks in advance!

[Marvin Rhoads]

Do you have access via the current management interface? If so, just use the "configure network..." command.

[JessF]

Hi Marvin,

yes, I can access the FTD via the current management interface. Just wanted to make sure that I don't lose access at all. The devices are already located in the data center and it would be very inconvenient if someone would have to go there.

[Marvin Rhoads]

If you're just changing addresses within the current subnet then it's a pretty low risk change. Changing subnets is a bit bigger deal since the gateway and, presumably, connections on the downstream device, would also have to change.

ssh via a data interface is only possible if you change that interface to also have the management role. Reference: https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/720/management-center-device-config-72/get-started-device-management.html#Cisco_Concept.dita_a3adf1ee-a270-4ff4-8b7b-3f9a3f4f1636

[Aref Alsouqi]

I think even if you enable management over a regular data interface, the actual management traffic would still need to go all the way down to the management interface. In fact, in that case the gateway of the management interface would be the data interface IP, otherwise, the remote SSH connection won't work. Imo enabling management on a data interface and enabling SSH would add complexity to what you are trying to do. I think it would be enough to double check that the new IP address of the management interface is routable up to its default gateway, added to any encryption domains and ACLs, and you would be safe to use the "configure network ..." command via SSH to the existing management IP.

[JessF]

We tried to change the ip via "configure network..." and it did not work. We lost access to the FTD and had to go to the data center. It was NOT a routing or ACL issue. When we checked the configuration we found that the FTD still had the old ip address.

Any ideas on that?

We still have to change the management ip of the second FTD (that is located in a different data center) and it would be great if this would work better.